Summary
- Environment: LiteLLM release workflows, PyPI and container registries
- Operational impact: Poisoned version 1.107.0 artifacts distributed and removed
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 23, 2026; updated as evidence emerges.
What happened
Impact
All seven PyPI wheels were affected, available from 11:39:51 to 13:23 UTC. Compromised container tags included v1.107.0, latest, main-latest and main-stable. LiteLLM said its private enterprise registry was unaffected. No downstream victim total is established. [1]
Timeline
Malicious release published and removed
The incident report records the publication windows and subsequent removals.
[1]Briefing updated
This briefing was last reviewed and updated on October 23, 2026.
Threat Group & Attack Vector
LiteLLM said stolen developer GitHub credentials enabled attackers to disable branch protection and change the release workflow. It built poisoned artifacts from an attacker-controlled repository; the official source tag lacked the malware. [1]
The project suspected tokens were obtained from internal deployment logs. Entry into that deployment and the suspected vulnerability remained unconfirmed. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1195.002 — Compromise Software Supply Chain: poisoned releases reached software distribution channels. [1]
Response
LiteLLM removed affected artifacts and advised rebuilding compromised environments and rotating reachable secrets. It warned that starting Python or pip could rerun malicious startup files. [1]